0x00phantom-hat/cve-2023-6972-exploit-arbitrary-file-deletionThis repository contains a Proof of Concept (PoC) exploit for CVE-2023-6972.
This repository contains a Proof of Concept (PoC) exploit for CVE-2023-6972.
The vulnerability allows for Unauthenticated Arbitrary File Deletion (AFD) in Wordpress Backup Migration Plugin <=1.3.9 , Which can be chained to RCE By Deleting wp-config.php . This exploit script automates the vulnerability check and exploitation process.
Note: A comprehensive technical breakdown, full case study, and root cause analysis of this exploit available at https://medium.com/@phantom_hat/cve-2023-6972-wordpress-backup-migration-1-3-9-arbitrary-file-deletion-case-study-ccea1c5f8c4e
For Educational and Authorized Security Testing Purposes Only. This script is provided "as is" and the author holds no responsibility for any misuse or damage caused by its use. Always obtain explicit, written permission from the system owner before conducting any security testing.
requests libraryrich library (for the CLI interface)Install the required dependencies:
pip install -r requirements.txt
The exploit script (exploit.py) provides a CLI interface with two distinct modes:
Validates if the target URL is vulnerable to CVE-2023-6972 without firing the exploit.
python3 exploit.py check -u <TARGET_URL>
Example:
python3 exploit.py check -u http://example.com
Executes the vulnerability against the target URL.
python3 exploit.py exploit -u <TARGET_URL> -f <FILE_PATH> -n <FILE_NAME>
Options:
-u / --url: The target URL.-f / --file-path: The directory path to delete the file.-n / --file-name: The desired name of the file which you want to delete.Example:
python3 exploit.py exploit -u http://127.0.0.1 -f /tmp -n delete-me.txt
You can add the -v or --verbose flag to either command to enable detailed, and formatted visual logging and output.
python3 exploit.py exploit -u http://127.0.0.1 -f /tmp -n delete-me.txt --verbose